Field of the Invention
The invention relates to the field of information security, and more particularly to the field of securely recording, storing, and timestamping data files.
Discussion of the State of the Art
In the art of information security, it is often desirable to ensure the protection of sensitive information for a variety of purposes, such as companies protecting internal proprietary information, or customer data such as account numbers, identification information, or any of a wide variety of potentially sensitive material that malicious third parties may desire to tamper with. It will be appreciated by one having ordinary skill in the art that there is an ongoing and constantly evolving struggle between security providers and such malicious entities, effectively an electronic arms race in which each side continually strives to develop new means to achieve their goals and circumvent the other's countermeasures.
One particular sensitive area of information security, is that of file authentication. Particularly, while a large focus is put on protecting information in the sense of preventing unauthorized access (i.e., preventing unwanted individuals or entities from gaining access to files such as to erase or steal information), an additional area of concern remains regarding protecting individual data files from being tampered with or falsified. Tampering with a file, such as making minor alterations to content data or properties, or falsifying entire files such as substituting a new file with similar properties in an attempt to covertly manipulate data, is a key area of information security concern. For example, contact centers employed by a large number of corporate entities often record verbal interactions with customers (one familiar with the art will be reminded of the well-known disclaimer when calling a contact center, explaining that any calls may be recorded or monitored). While it is important to protect such files from a corporation's perspective against information theft, it may also be desirable for a user to ensure that their information remains secure—sometimes, even from the contact center or other entity creating a recording. By way of hypothetical example, should a dissatisfied customer call a contact center and the call be recorded, this customer may wish to use the call recording as evidence if legal action is taken against the contact center operator or any other entity to which the conversation that was recorded might be relevant. It then becomes critical to ensure that the recording of that call has not been tampered with or altered, and furthermore that the recording itself has not been falsified, erased, obfuscated, or otherwise manipulated in any way.
A further example would be a conversation between two corporate executives, that may be recorded as a means of evidence of their interaction (such as, for example, when discussing collaborative business plans that need to be kept on record). It may then become desirable for both parties involved to ensure the authenticity of the recording and its contents, such as any numbers discussed or legal arrangements made as a verbal contract may still be binding provided the veracity of the claim can be certified.
What is needed, then, is a means to certify and verify any particular file to ensure its authenticity, as well as protect such a file against any tampering, unauthorized access or duplication, and also to provide timestamp information for such a file so that a record exists not only of the content of the file, but the exact times at which a file was created, altered, or any other relevant operation was performed. Furthermore, any such security measures must be effective in securing a file against any potentially interested party, including those that might be responsible for the security of the file itself (as with the above example, a call recording between a customer and a contact center must be protected against tampering by the contact center or any affiliates, to ensure security is maintained for the customer).